The Internet protocol (IP) layer protocol utilized in packet network communications allows an IP packet to be separated en route into smaller fragments which are ultimately sent to the destination, referred to herein as the target system. Each fragment still belongs to the original IP packet, and can be reassembled by the target system to re-create the original IP packet.
Different kinds of operating systems have unique methods of fragment reassembly. These methods of reassembling fragments can be exploited by attackers. In their landmark 1998 paper, “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection,” Thomas Ptacek and Timothy Newsham exposed some weaknesses in intrusion detection systems (IDS). The authors revealed that an IDS cannot be effective and accurate because it does not necessarily process or even observe network traffic exactly as the destination host that receives the message does.
If an IDS utilizes a single reassembly method, it may not reassemble and process the packets in the same way that the destination system does. Consequently, an attack that successfully exploits these differences in fragment reassembly can cause the IDS to miss the malicious traffic.